Comment by zamalek

> TOTP is a great solution.

TOTP has a fatal flaw: it relies on the human to not paste the number into a phishing website. You can do a lot of bank transfers or whatever, in seconds, with a valid session derived from a phished TOTP.

Characterizing it as a sticky note on the desk is extremely dishonest.